@claude-flow/cli 3.54.1 → 3.56.0

package/dist/src/mcp-tools/hooks-tools.js

@@ -1154,14 +1154,59 @@ export const hooksRoute = {
             catch {
                 // AgentDB router not available — fall through to local routing
             }
+            // Trajectory learning persists SONA outcomes separately from the local
+            // semantic index. Only consume an eligible learned pattern here; native,
+            // Q-learning and keyword suggestions retain their existing routing paths.
+            try {
+                const sonaStart = performance.now();
+                const sona = await getSONAOptimizer();
+                const suggestion = await sona?.getRoutingSuggestion(task);
+                const { isSupportedSonaAgent } = await import('../memory/sona-optimizer.js');
+                if (suggestion?.source === 'sona-pattern'
+                    && Number.isFinite(suggestion.confidence)
+                    && suggestion.confidence >= 0.6 && suggestion.confidence <= 1
+                    && isSupportedSonaAgent(suggestion.agent)) {
+                    const confidence = Math.round(suggestion.confidence * 100) / 100;
+                    const complexity = task.length > 200 ? 'high' : task.length < 50 ? 'low' : 'medium';
+                    return {
+                        task,
+                        routing: { method: 'sona-pattern', backend: 'SONA persisted keyword patterns', latencyMs: performance.now() - sonaStart, throughput: 'N/A' },
+                        matched: true,
+                        matchedPattern: 'sona-pattern',
+                        semanticMatches: [],
+                        primaryAgent: {
+                            type: suggestion.agent,
+                            confidence,
+                            reason: `Persisted SONA outcome pattern (${Math.round(suggestion.confidence * 100)}% confidence)`,
+                        },
+                        alternativeAgents: suggestion.alternatives
+                            .filter(alternative => isSupportedSonaAgent(alternative.agent) && Number.isFinite(alternative.score))
+                            .map(alternative => ({
+                            type: alternative.agent,
+                            confidence: Math.round(alternative.score * 100) / 100,
+                            reason: 'Alternative from persisted SONA patterns',
+                        })),
+                        estimatedMetrics: {
+                            successProbability: confidence,
+                            estimatedDuration: complexity === 'high' ? '2-4 hours' : complexity === 'medium' ? '30-60 min' : '10-30 min',
+                            complexity,
+                        },
+                        swarmRecommendation: null,
+                        learning: { source: suggestion.source, matchedKeywords: suggestion.matchedKeywords },
+                    };
+                }
+            }
+            catch {
+                // Optional SONA state unavailable — preserve the existing local route.
+            }
         }
         return routeTaskLocal(task, context, useSemanticRouter);
     }),
 };
 /**
  * hooks_route's local routing (semantic index + keyword fallback), run after the
- * AgentDB pre-route. Shared with {@link routeTaskForBench} so the benchmark
- * measures exactly the path hooks_route takes. (Body kept at its original
+ * AgentDB and eligible SONA pre-routes. Shared with {@link routeTaskForBench}
+ * so the benchmark measures this local path. (Body kept at its original
  * indentation to keep this refactor's diff small.)
  */
 async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride) {

package/dist/src/mcp-tools/memory-tools.js

@@ -1500,7 +1500,21 @@ export const memoryTools = [
             // entry body. Without this, `value` is always null because listEntries
             // strips content by default (callers pay for the JSON parse only when
             // they need it).
-            const all = await listEntries({ limit: 100000, namespace, includeContent: true });
+            // A successful export must cover the whole reported store. Read all
+            // pages before touching an existing snapshot, including on read failure.
+            const entries = [];
+            let total;
+            do {
+                const page = await listEntries({ limit: 10000, offset: entries.length, namespace, includeContent: true });
+                if (!page.success)
+                    return { error: page.error || 'Could not read memory for export' };
+                total ??= page.total;
+                if (page.entries.length === 0 && entries.length < total) {
+                    return { error: `Incomplete memory export: read ${entries.length} of ${total} entries` };
+                }
+                entries.push(...page.entries);
+            } while (entries.length < total);
+            const all = { entries };
             const payload = {
                 schema: 'ruflo-memory-export/v1',
                 exportedAt: new Date().toISOString(),
@@ -1595,6 +1609,8 @@ export const memoryTools = [
             }
             let imported = 0;
             let skipped = 0;
+            let failed = 0;
+            const errors = [];
             for (const e of entries) {
                 if (!e || typeof e.key !== 'string') {
                     skipped++;
@@ -1603,19 +1619,22 @@ export const memoryTools = [
                 const value = typeof e.value === 'string' ? e.value : JSON.stringify(e.value ?? null);
                 try {
                     const result = await storeEntry({ key: e.key, value, namespace: nsOverride ?? e.namespace ?? 'default', upsert: input.merge !== false, dbPath });
-                    if (result.success) {
-                        imported++;
-                        if (result.embedding)
-                            vectors++;
-                    }
-                    else
-                        skipped++;
+                    if (!result.success)
+                        throw new Error(result.error || 'Memory write was rejected');
+                    imported++;
+                    if (result.embedding)
+                        vectors++;
                 }
-                catch {
-                    skipped++;
+                catch (error) {
+                    failed++;
+                    if (errors.length < 10)
+                        errors.push(`${e.key}: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
             return {
+                success: failed === 0,
+                error: failed > 0 ? `${failed} memory write(s) failed: ${errors.join('; ')}` : undefined,
+                failed,
                 inputPath,
                 imported: { entries: imported, vectors, patterns: 0 },
                 skipped,

package/dist/src/mcp-tools/record-store.d.ts

@@ -0,0 +1,3 @@
+/** Only an absent store is empty. Failed reads must never authorize replacement. */
+export declare function readRecordStore<T>(path: string, collection: string, empty: () => T): T;
+//# sourceMappingURL=record-store.d.ts.map

package/dist/src/mcp-tools/record-store.js

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs';
+/** Only an absent store is empty. Failed reads must never authorize replacement. */
+export function readRecordStore(path, collection, empty) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf-8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return empty();
+        throw error;
+    }
+    const store = JSON.parse(text);
+    const records = store?.[collection];
+    if (!store || typeof store !== 'object' || Array.isArray(store)
+        || !records || typeof records !== 'object' || Array.isArray(records)) {
+        throw new Error(`Invalid ${collection} store at ${path}; existing data was preserved`);
+    }
+    return store;
+}
+//# sourceMappingURL=record-store.js.map

package/dist/src/mcp-tools/session-tools.js

@@ -10,6 +10,33 @@ import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+// Imported snapshots become live stores on restore. Validate their containers
+// before registering them, while allowing older metadata-only snapshots.
+function validateImportedSession(value) {
+    if (!isRecord(value) || (typeof value.name !== 'string' && !isSessionRecordLike(value))) {
+        return 'Invalid session: Not a session record; expected a named snapshot or snapshot data';
+    }
+    if (value.name !== undefined && typeof value.name !== 'string') {
+        return 'Invalid session: name must be a string';
+    }
+    if (value.data === undefined)
+        return undefined;
+    if (!isRecord(value.data))
+        return 'Invalid session: data must be an object';
+    for (const [component, collection] of [['tasks', 'tasks'], ['agents', 'agents'], ['memory', 'entries']]) {
+        const store = value.data[component];
+        if (store === undefined)
+            continue;
+        if (!isRecord(store) || !isRecord(store[collection]) ||
+            Object.values(store[collection]).some(record => !isRecord(record))) {
+            return `Invalid session: data.${component}.${collection} must be a record map`;
+        }
+    }
+    return undefined;
+}
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const SESSION_DIR = 'sessions';
@@ -306,9 +333,9 @@ export const sessionTools = [
             properties: {
                 name: { type: 'string', description: 'Session name' },
                 description: { type: 'string', description: 'Session description' },
-                includeMemory: { type: 'boolean', description: 'Include memory in session' },
-                includeTasks: { type: 'boolean', description: 'Include tasks in session' },
-                includeAgents: { type: 'boolean', description: 'Include agents in session' },
+                includeMemory: { type: 'boolean', default: true, description: 'Include memory in session' },
+                includeTasks: { type: 'boolean', default: true, description: 'Include tasks in session' },
+                includeAgents: { type: 'boolean', default: true, description: 'Include agents in session' },
             },
             required: ['name'],
         },
@@ -325,9 +352,9 @@ export const sessionTools = [
             const sessionId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
             // Load related data based on options
             const { data, memoryCapture } = await loadRelatedStores({
-                includeMemory: input.includeMemory,
-                includeTasks: input.includeTasks,
-                includeAgents: input.includeAgents,
+                includeMemory: input.includeMemory !== false,
+                includeTasks: input.includeTasks !== false,
+                includeAgents: input.includeAgents !== false,
             });
             // Calculate stats
             const stats = {
@@ -692,19 +719,26 @@ export const sessionTools = [
                     return { error: `Invalid session JSON: ${e.message}` };
                 }
             }
-            if (!isSessionRecordLike(parsed)) {
-                return { error: 'Not a session record: expected an object produced by session export' };
-            }
+            const validationError = validateImportedSession(parsed);
+            if (validationError)
+                return { error: validationError };
+            const record = parsed;
             const newId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
-            const stats = { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0, ...(parsed.stats || {}) };
+            const stats = {
+                tasks: Object.keys(record.data?.tasks?.tasks || {}).length,
+                agents: Object.keys(record.data?.agents?.agents || {}).length,
+                memoryEntries: countMemoryEntries(record.data?.memory),
+                totalSize: 0,
+            };
             const session = {
                 sessionId: newId,
-                name: input.name ? String(input.name) : (parsed.name || 'imported-session'),
-                description: parsed.description,
+                name: input.name ? String(input.name) : (record.name || 'imported-session'),
+                description: record.description,
                 savedAt: new Date().toISOString(),
                 stats,
-                data: parsed.data,
+                data: record.data,
             };
+            session.stats.totalSize = Buffer.byteLength(JSON.stringify(session), 'utf-8');
             saveSession(session);
             let activated = false;
             if (input.activate === true) {

package/dist/src/mcp-tools/task-tools.js

@@ -5,6 +5,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { readRecordStore } from './record-store.js';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
@@ -24,17 +25,7 @@ function ensureTaskDir() {
     }
 }
 function loadTaskStore() {
-    try {
-        const path = getTaskPath();
-        if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
-        }
-    }
-    catch {
-        // Return empty store on error
-    }
-    return { tasks: {}, version: '3.0.0' };
+    return readRecordStore(getTaskPath(), 'tasks', () => ({ tasks: {}, version: '3.0.0' }));
 }
 function saveTaskStore(store) {
     ensureTaskDir();
@@ -378,6 +369,9 @@ export const taskTools = [
                 return { taskId, error: 'Task not found' };
             }
             const previouslyAssigned = [...task.assignedTo];
+            // Load agent store to sync worker state
+            const agentStorePath = join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json');
+            readRecordStore(agentStorePath, 'agents', () => ({ agents: {} }));
             if (input.unassign) {
                 // Revert previously assigned agents to idle
                 releaseAgents(previouslyAssigned, taskId);

package/dist/src/mcp-tools/workflow-tools.js

@@ -41,6 +41,22 @@ function saveWorkflowStore(store) {
     ensureWorkflowDir();
     writeFileSync(getWorkflowPath(), JSON.stringify(store, null, 2), 'utf-8');
 }
+// A paused in-flight step still owns its executor. Resume joins that execution
+// instead of dispatching the same side effect again (within this process).
+const workflowExecutions = new Map();
+const workflowExecutionKey = (workflowId) => JSON.stringify([getWorkflowPath(), workflowId]);
+function withWorkflowExecution(workflowId, execute) {
+    const key = workflowExecutionKey(workflowId);
+    if (workflowExecutions.has(key)) {
+        return Promise.resolve({ workflowId, error: 'Workflow already executing' });
+    }
+    const execution = execute();
+    workflowExecutions.set(key, execution);
+    return execution.finally(() => {
+        if (workflowExecutions.get(key) === execution)
+            workflowExecutions.delete(key);
+    });
+}
 export const workflowTools = [
     {
         name: 'workflow_run',
@@ -227,7 +243,7 @@ export const workflowTools = [
             },
             required: ['workflowId'],
         },
-        handler: async (input) => {
+        handler: async (input) => withWorkflowExecution(input.workflowId, async () => {
             // Validate user-provided input (#1425)
             const vId = validateIdentifier(input.workflowId, 'workflowId');
             if (!vId.valid)
@@ -241,13 +257,50 @@ export const workflowTools = [
             if (workflow.status === 'running') {
                 return { workflowId, error: 'Workflow already running' };
             }
+            // Indices may name a step or the end boundary (used when resuming
+            // after the final step). Reject invalid control flow before any writes.
+            const validIndex = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= workflow.steps.length;
+            const startFromStep = input.startFromStep === undefined ? 0 : input.startFromStep;
+            if (!validIndex(startFromStep)) {
+                return { workflowId, error: `startFromStep must be an integer between 0 and ${workflow.steps.length}` };
+            }
+            for (const step of workflow.steps) {
+                if (step.type !== 'condition')
+                    continue;
+                for (const target of ['thenStep', 'elseStep']) {
+                    if (step.config[target] !== undefined && !validIndex(step.config[target])) {
+                        return { workflowId, error: `${step.stepId}.${target} must be an integer between 0 and ${workflow.steps.length}` };
+                    }
+                }
+            }
+            const persistProgress = () => {
+                // An awaited step may overlap pause/stop/delete or a sibling workflow
+                // mutation. Merge only this workflow into the latest store snapshot.
+                const latest = loadWorkflowStore();
+                const current = latest.workflows[workflowId];
+                if (!current) {
+                    workflow.status = 'failed';
+                    workflow.error = 'Workflow was deleted during execution';
+                    return;
+                }
+                if (current.status === 'failed') {
+                    Object.assign(workflow, current);
+                    return;
+                }
+                if (current.status === 'paused' && workflow.status !== 'failed')
+                    workflow.status = 'paused';
+                latest.workflows[workflowId] = workflow;
+                saveWorkflowStore(latest);
+            };
             // Inject runtime variables
             if (input.variables) {
                 workflow.variables = { ...workflow.variables, ...input.variables };
             }
             workflow.status = 'running';
             workflow.startedAt = new Date().toISOString();
-            workflow.currentStep = input.startFromStep || 0;
+            delete workflow.error;
+            delete workflow.completedAt;
+            workflow.currentStep = startFromStep;
             saveWorkflowStore(store);
             // ADR-095 G3: real workflow runtime. Walk the steps in order;
             // dispatch each by type. Persist progress after each step so a
@@ -277,22 +330,26 @@ export const workflowTools = [
             while (i < workflow.steps.length) {
                 // Honor pause/cancel signals between steps.
                 const live = loadWorkflowStore().workflows[workflowId];
-                if (!live || live.status === 'paused') {
+                if (!live) {
+                    workflow.status = 'failed';
+                    workflow.error = 'Workflow was deleted during execution';
+                    break;
+                }
+                if (live.status === 'paused') {
                     workflow.status = 'paused';
                     workflow.currentStep = i;
-                    saveWorkflowStore(store);
+                    persistProgress();
                     break;
                 }
                 if (live.status === 'failed') {
-                    workflow.status = 'failed';
-                    saveWorkflowStore(store);
+                    Object.assign(workflow, live);
                     break;
                 }
                 const step = workflow.steps[i];
                 step.status = 'running';
                 step.startedAt = new Date().toISOString();
                 const stepStart = Date.now();
-                saveWorkflowStore(store);
+                persistProgress();
                 let stepEntry = { stepId: step.stepId, type: step.type, status: 'running' };
                 try {
                     if (step.type === 'task') {
@@ -364,7 +421,7 @@ export const workflowTools = [
                     workflow.status = 'failed';
                     workflow.error = msg;
                     workflow.completedAt = new Date().toISOString();
-                    saveWorkflowStore(store);
+                    persistProgress();
                     return {
                         workflowId,
                         status: 'failed',
@@ -379,17 +436,18 @@ export const workflowTools = [
                     stepEntry.durationMs = Date.now() - stepStart;
                 stepResults.push(stepEntry);
                 workflow.currentStep = i + 1;
-                saveWorkflowStore(store);
+                persistProgress();
                 i++;
             }
             if (workflow.status === 'running') {
                 workflow.status = 'completed';
                 workflow.completedAt = new Date().toISOString();
-                saveWorkflowStore(store);
+                persistProgress();
             }
             return {
                 workflowId,
                 status: workflow.status,
+                ...(workflow.error ? { error: workflow.error } : {}),
                 totalSteps: workflow.steps.length,
                 stepsCompleted: stepResults.filter(s => s.status === 'completed').length,
                 stepsSkipped: stepResults.filter(s => s.status === 'skipped').length,
@@ -399,7 +457,7 @@ export const workflowTools = [
                 completedAt: workflow.completedAt,
                 durationMs: Date.now() - startedAt,
             };
-        },
+        }),
     },
     {
         name: 'workflow_status',
@@ -560,24 +618,15 @@ export const workflowTools = [
             if (workflow.status !== 'paused') {
                 return { workflowId, error: 'Workflow not paused' };
             }
-            workflow.status = 'running';
-            saveWorkflowStore(store);
-            // Report current step states — do not auto-complete them
-            const stepStates = workflow.steps.map(step => ({
-                stepId: step.stepId,
-                name: step.name,
-                status: step.status,
-            }));
-            const remainingSteps = workflow.steps.length - workflow.currentStep;
-            return {
-                workflowId,
-                status: workflow.status,
-                resumed: true,
-                currentStep: workflow.currentStep,
-                remainingSteps,
-                steps: stepStates,
-                _note: 'Workflow resumed. Steps remain in their current state and must be executed via task tools.',
-            };
+            const active = workflowExecutions.get(workflowExecutionKey(workflowId));
+            if (active) {
+                workflow.status = 'running';
+                saveWorkflowStore(store);
+                return { ...(await active), resumed: true };
+            }
+            const execute = workflowTools.find(tool => tool.name === 'workflow_execute');
+            const result = await execute.handler({ workflowId, startFromStep: workflow.currentStep });
+            return { ...result, resumed: true };
         },
     },
     {

package/dist/src/memory/append-conditions.d.ts

@@ -0,0 +1,28 @@
+export type AppendCondition = {
+    namespace: string;
+} & ({
+    key: string;
+    sha256: string;
+    latestPrefix?: string;
+} | {
+    absent: true;
+    latestPrefix: string;
+} | {
+    keysSha256: string;
+    count: number;
+});
+export declare class AppendConditionFailed extends Error {
+}
+export declare function validateAppendConditions(input: unknown): AppendCondition[];
+interface NativeReader {
+    prepare(sql: string): {
+        all(...parameters: string[]): Array<{
+            key: string;
+            content: string;
+            status: string | null;
+        }>;
+    };
+}
+export declare function assertAppendConditions(db: NativeReader, conditions: AppendCondition[]): void;
+export {};
+//# sourceMappingURL=append-conditions.d.ts.map

package/dist/src/memory/append-conditions.js

@@ -0,0 +1,56 @@
+/** Native append predicates checked in the SAME write transaction as an immutable insert. */
+import { createHash } from 'node:crypto';
+export class AppendConditionFailed extends Error {
+}
+const text = (value, limit) => typeof value === 'string' && value.length > 0 && value.length <= limit;
+const digest = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+export function validateAppendConditions(input) {
+    if (!Array.isArray(input) || input.length < 1 || input.length > 8)
+        throw new TypeError('append conditions must contain 1-8 predicates');
+    return input.map(condition => {
+        if (!condition || typeof condition !== 'object' || Array.isArray(condition))
+            throw new TypeError('invalid append condition');
+        const row = condition;
+        const fields = Object.keys(row).sort().join(',');
+        const validRecord = ['key,namespace,sha256', 'key,latestPrefix,namespace,sha256'].includes(fields)
+            && text(row.key, 1024) && digest(row.sha256) && (row.latestPrefix === undefined || text(row.latestPrefix, 1024));
+        const validAbsent = fields === 'absent,latestPrefix,namespace' && row.absent === true && text(row.latestPrefix, 1024);
+        const validKeys = fields === 'count,keysSha256,namespace' && digest(row.keysSha256)
+            && Number.isSafeInteger(row.count) && row.count >= 0 && row.count <= 100_000;
+        if (!text(row.namespace, 256) || !(validRecord || validAbsent || validKeys))
+            throw new TypeError('invalid append condition');
+        return row;
+    });
+}
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+export function assertAppendConditions(db, conditions) {
+    for (const condition of conditions) {
+        if ('keysSha256' in condition) {
+            const rows = db.prepare("SELECT key FROM memory_entries WHERE namespace = ? AND (status = 'active' OR status IS NULL)")
+                .all(condition.namespace);
+            const keys = rows.map(row => row.key).sort();
+            if (keys.length !== condition.count || sha(JSON.stringify(keys)) !== condition.keysSha256) {
+                throw new AppendConditionFailed('immutable append rejected: namespace membership changed');
+            }
+            continue;
+        }
+        if ('key' in condition) {
+            const rows = db.prepare('SELECT key, content, status FROM memory_entries WHERE namespace = ? AND key = ?')
+                .all(condition.namespace, condition.key);
+            if (rows.length !== 1 || !['active', null].includes(rows[0].status)
+                || typeof rows[0].content !== 'string' || sha(rows[0].content) !== condition.sha256) {
+                throw new AppendConditionFailed('immutable append rejected: expected parent/authority bytes changed or absent');
+            }
+        }
+        if (condition.latestPrefix !== undefined) {
+            // Include tombstones: deleting a new authority slot must never rewind to an older authority.
+            const pattern = condition.latestPrefix.replace(/[\\%_]/g, character => `\\${character}`) + '%';
+            const latest = db.prepare("SELECT key, content, status FROM memory_entries WHERE namespace = ? AND key LIKE ? ESCAPE '\\' ORDER BY key COLLATE BINARY DESC LIMIT 1")
+                .all(condition.namespace, pattern);
+            if ('absent' in condition ? latest.length !== 0 : latest.length !== 1 || latest[0].key !== condition.key) {
+                throw new AppendConditionFailed('immutable append rejected: newer parent/authority slot exists');
+            }
+        }
+    }
+}
+//# sourceMappingURL=append-conditions.js.map

package/dist/src/memory/graph-edge-writer.d.ts

@@ -29,6 +29,15 @@
  *
  * @module v3/cli/memory/graph-edge-writer
  */
+/**
+ * True iff the memory.db bridge at `customDbPath` (or the default location)
+ * is currently RFE1-encrypted-at-rest. Callers that receive `null` from
+ * getBridgeDb()/insertGraphEdge() can use this to avoid recommending the
+ * destructive `memory init` command for this specific, non-corrupt case.
+ */
+export declare function isBridgeDbEncryptedAtRest(customDbPath?: string): boolean;
+/** Test-only: clear the once-per-path warning dedup set. */
+export declare function _resetRfe1WarningFlag(): void;
 /**
  * Checkpoint and close the cached handle if it is open (optionally only if it
  * is open on `dbPath`). Returns true if a handle was released. Never throws.